問題1
Install RHACM Operator (Web Console)
Install RHACM Operator (Web Console)
正確答案:
See the solution below in Explanation.
Explanation:
* Log in to the OpenShift Web Console as a cluster-admin user.
* Go to Operators # OperatorHub .
* OperatorHub is the catalog of available operators.
* In the search box, type: Advanced Cluster Management .
* Click Advanced Cluster Management for Kubernetes (Red Hat ACM).
* Click Install .
* In the install wizard:
* Update channel : choose the recommended/stable channel for your lab.
* Installation mode : typically "All namespaces on the cluster" (default).
* Installed Namespace : select or create open-cluster-management .
* Click Install and wait for the operator to show Succeeded in:
* Operators # Installed Operators .
Why these steps matter:
* Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.
Explanation:
* Log in to the OpenShift Web Console as a cluster-admin user.
* Go to Operators # OperatorHub .
* OperatorHub is the catalog of available operators.
* In the search box, type: Advanced Cluster Management .
* Click Advanced Cluster Management for Kubernetes (Red Hat ACM).
* Click Install .
* In the install wizard:
* Update channel : choose the recommended/stable channel for your lab.
* Installation mode : typically "All namespaces on the cluster" (default).
* Installed Namespace : select or create open-cluster-management .
* Click Install and wait for the operator to show Succeeded in:
* Operators # Installed Operators .
Why these steps matter:
* Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.
問題2
Troubleshoot a policy that shows "Pending" (no placement decisions)
Troubleshoot a policy that shows "Pending" (no placement decisions)
正確答案:
See the solution below in Explanation.
Explanation:
* Confirm the policy exists in the namespace:
oc get policy -n team-dev
* Confirm Placement exists and selects clusters:
oc get placement -n team-dev
oc get placementdecision -n team-dev
* Confirm PlacementBinding points to correct placement + policy:
oc get placementbinding -n team-dev -o yaml
* Fix common mistakes:
* wrong namespace
* placement name mismatch
* missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.
Explanation:
* Confirm the policy exists in the namespace:
oc get policy -n team-dev
* Confirm Placement exists and selects clusters:
oc get placement -n team-dev
oc get placementdecision -n team-dev
* Confirm PlacementBinding points to correct placement + policy:
oc get placementbinding -n team-dev -o yaml
* Fix common mistakes:
* wrong namespace
* placement name mismatch
* missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.
問題3
Create Overlay Directory (Kustomize)
Create Overlay Directory (Kustomize)
正確答案:
See the solution below in Explanation.
Explanation:
* Create overlay structure:
* mkdir -p overlays/production
* Confirm:
* ls -R overlays
Why this matters:
* Kustomize overlays let you maintain base manifests and environment-specific patches (production vs dev, etc.).
Explanation:
* Create overlay structure:
* mkdir -p overlays/production
* Confirm:
* ls -R overlays
Why this matters:
* Kustomize overlays let you maintain base manifests and environment-specific patches (production vs dev, etc.).
問題4
Grant a team group "edit" access to the namespace that has a ClusterSetBinding
Grant a team group "edit" access to the namespace that has a ClusterSetBinding
正確答案:
See the solution below in Explanation.
Explanation:
* Create a group (example) and add users:
oc adm groups new dev-team
oc adm groups add-users dev-team user1 user2
* Grant namespace access:
oc adm policy add-role-to-group edit dev-team -n team-dev
* Validate with a user token/login (or check rolebindings):
oc get rolebinding -n team-dev | grep dev-team
Why this matters:
ACM access patterns commonly combine namespace RBAC + ClusterSetBinding to scope what teams can manage.
Explanation:
* Create a group (example) and add users:
oc adm groups new dev-team
oc adm groups add-users dev-team user1 user2
* Grant namespace access:
oc adm policy add-role-to-group edit dev-team -n team-dev
* Validate with a user token/login (or check rolebindings):
oc get rolebinding -n team-dev | grep dev-team
Why this matters:
ACM access patterns commonly combine namespace RBAC + ClusterSetBinding to scope what teams can manage.
問題5
Create a namespace for a team and bind a ManagedClusterSet to that namespace
Create a namespace for a team and bind a ManagedClusterSet to that namespace
正確答案:
See the solution below in Explanation.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.